Closing Buddy

Privacy policy

English translation provided for convenience. The French version prevails for legal purposes.

Closing Buddy is a real-time sales assistant for professionals. As such, the Service processes personal data about its users and, potentially, about their counterparties during sales calls. This policy transparently describes the data we collect, the purposes of processing, the processors involved, retention periods and the rights you have under the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and the French “Informatique et Libertés” law.

This policy supplements the Terms of service and the Legal notice. It may evolve; any substantial change will be notified to users (see section 14).

1. Data controller

The data controller is the publisher of the Closing Buddy Service (see Legal notice). The controller determines the purposes and means of the processing described below. For any data protection question, contact us at support@closingbuddy.io. A Data Protection Officer (DPO) may be designated on request for Business and Enterprise customers under the Data Processing Agreement (DPA).

2. Data we collect

2.1 Identification and account data

  • First name, last name, email, password (hashed and salted with bcrypt).
  • Company, professional role, sector, language, timezone.
  • User preferences, interface settings, selected plan.
  • Account creation date, last login, status (active, suspended, deleted).

2.2 Billing data

Payments are handled in full by Stripe. Closing Buddy never stores card numbers. We only keep what is needed for billing: Stripe customer ID, subscribed plan, billed amounts, PDF invoices, charge dates, payment status, billing address and, where applicable, EU VAT number.

2.3 Session data and call briefs

  • Briefs prepared before each call: context, objective, prospect profile, free notes.
  • Offer profiles: descriptions, prices, arguments, scripts, anticipated objections, target persona.
  • Call type (discovery, qualification, closing, negotiation, follow-up), duration, status, timestamps.
  • Consent declared by the user before each live call.

2.4 Voice data and real-time transcripts

When you start a live call, Closing Buddy captures the audio stream from your microphone and/or the call's audio output and forwards it to a transcription provider to convert it into text. The raw audio stream is not persistently stored: it transits in memory for the time of transcription and is then destroyed. Only the transcribed text (verbatim) is temporarily kept to produce live suggestions and the post-call report.

2.5 AI-derived data

  • Detected objections, intents, buying signals, friction points.
  • Answer suggestions, follow-ups, reframes, stylistic recommendations.
  • Post-call summaries, synthetic indicators, learning recommendations.
  • Analysis metadata (objection categories, frequency, processing duration).

2.6 Technical data and logs

  • IP address, device type, browser, operating system, language.
  • Access logs, error logs, API logs (success/failure of internal calls).
  • Strictly necessary cookies and technical storage required to operate the Service (session, preferences). See section 11.
  • Anonymised product usage indicators (volumes, frequency, latencies).

3. Purposes and legal bases

  • Provide and operate the Service (account creation, briefs, live calls, reports, history, billing) — contract performance.
  • Billing, subscriptions, support — contract performance and legal obligation (accounting, tax).
  • Secure the Service (fraud prevention, abuse detection, logging) — legitimate interest.
  • Improve AI suggestion quality using aggregated and anonymised data — legitimate interest. No identifiable client data is used to train third-party models (see section 5).
  • Product communications (newsletter, feature announcements) — consent, revocable at any time from each email or from your account.

4. Counterparty consent

Closing Buddy is a sales-assistance copilot, not a covert listening tool. The user commits to informing their counterparty that the exchange is assisted, transcribed or analysed by an AI assistant, and to obtain their agreement where required by applicable law (in France, in particular articles 226-1 et seq. of the Criminal Code and GDPR obligations). An explicit consent checkbox must be ticked by the user before each live call. Closing Buddy must never be used to analyse a conversation without a participant's knowledge. Any contrary use is the sole responsibility of the user.

5. AI processing

For real-time transcription and suggestion generation, Closing Buddy relies on AI models provided by OpenAI (transcription and reasoning) and, where applicable, by other equivalent providers. These providers contractually commit to not reusing client data to train their models (“no training” clauses). Data transmitted for processing is limited to the strict minimum (transcript, brief, offer context, detected objection).

AI-produced suggestions are decision-support: they do not bind Closing Buddy's liability regarding what the user actually says during the call. The user retains full control over their words and commercial decisions. No fully automated decision producing legal effects on the counterparty is taken by the Service within the meaning of GDPR article 22.

6. Processors and recipients

Closing Buddy uses processors selected for their security and compliance posture. The list below may evolve; any substantial change will be documented:

  • Supabase — application infrastructure (PostgreSQL database, authentication, file storage, functions). EU hosting. Data encrypted at rest. Strictly restricted and logged access.
  • OpenAI — real-time transcription and AI suggestion generation. Primary hosting in the United States, framed by the European Commission's Standard Contractual Clauses (SCCs). “No training” contractual commitment on API data.
  • Stripe — payments and billing. PCI-DSS level 1 certified. Transfers framed by SCCs.
  • Cloudflare — CDN, security (WAF, anti-DDoS), edge compute. Transfers framed by SCCs, European presence.
  • Hostinger — marketing site hosting. EU hosting.
  • Resend (or equivalent) — transactional email delivery (account creation, password reset, invoices). Transfers framed by SCCs.

No data is sold to third parties, and no data is shared for advertising purposes.

7. Transfers outside the European Union

Some processors (OpenAI, Stripe, Cloudflare, Resend) may process data from or to countries located outside the European Union, in particular the United States. These transfers are framed by the Standard Contractual Clauses approved by the European Commission (decision 2021/914), supplemented where appropriate by technical measures (encryption, minimisation) and organisational measures. A copy of the applicable safeguards is available on request at support@closingbuddy.io.

8. Retention periods

  • User account: kept while the account is active. Personal data deleted within 30 days of account closure, subject to legal obligations.
  • Briefs and reports: kept while the account is active. Exportable at any time.
  • Verbatim transcripts: automatically purged beyond 90 days. Only derived data (summaries, indicators, detected objections) is kept beyond this period.
  • Raw audio stream: not stored, destroyed at the end of transcription.
  • Billing data: kept for 10 years from the close of the accounting year (accounting and tax obligations — art. L123-22 of the French Commercial Code).
  • Technical logs: 90 days maximum, except in case of a security incident.
  • Marketing emails: until withdrawal of consent, then 3 years for proof purposes.

9. Security

Closing Buddy implements technical and organisational measures proportionate to the sensitivity of the data:

  • TLS 1.2+ encryption for all communications in transit.
  • Encryption at rest on the database and file storage.
  • Row-Level Security (RLS) enabled on all sensitive tables — each user can only access their own data.
  • Passwords hashed with salted bcrypt.
  • Two-factor authentication (MFA) available on the account.
  • Logical data isolation between users and between customers.
  • Administrator access logging and alerts on abnormal access patterns.
  • Least-privilege policy: data access restricted to what is strictly necessary to operate the Service and provide support.
  • Regular dependency audits (vulnerabilities) and security updates.

10. Your rights

Under GDPR, you have the following rights at any time:

  • Right of access to data concerning you.
  • Right to rectification of inaccurate or incomplete data.
  • Right to erasure (“right to be forgotten”), within the limits of the legal obligations applying to the Service.
  • Right to restriction of processing.
  • Right to object on legitimate grounds, in particular for processing based on legitimate interest.
  • Right to portability of your data, in a structured, machine-readable format.
  • Right to withdraw consent at any time, for processing based on consent, without affecting the lawfulness of prior processing.
  • Right to give instructions regarding the fate of your data after your death.
  • Right to lodge a complaint with the CNIL (www.cnil.fr) if you consider that your rights are not respected.

To exercise these rights, write to support@closingbuddy.io with the subject of your request. We may need to ask for proof of identity. A reply is provided within one month, extendable by two months for complex requests.

11. Cookies

Closing Buddy uses only cookies and technical storage that are strictly necessary to operate the Service: authentication session, interface preferences (language, theme), CSRF token. These cookies do not require prior consent within the meaning of article 82 of the “Informatique et Libertés” law. No advertising cookies or third-party audience measurement cookies are set without your explicit consent. You can block cookies from your browser, but this may prevent the Service from working correctly.

12. Minors

Closing Buddy is a strictly B2B service, reserved for adult professionals. We do not knowingly collect data about minors. If you believe that a minor has sent us personal data, contact us: we will delete it as soon as possible.

13. Data breaches

In the event of a personal data breach likely to result in a risk to the rights and freedoms of the data subjects, Closing Buddy notifies the CNIL within 72 hours in accordance with GDPR article 33. Where the breach is likely to result in a high risk, the affected users are also informed as soon as possible, with a clear description of the nature of the breach and the measures taken to address it.

14. Changes to this policy

This policy may be modified at any time to reflect regulatory, technical or organisational changes. Substantial changes are notified by email to active users and/or via a banner in the application, at least 30 days before they take effect when they affect users' rights. The last update date is shown at the bottom of this page.

15. Contact

For any question related to this policy or to exercise your rights: support@closingbuddy.io.